Written by Jacob Kosoff and published in September 2013 by the RMA Journal. This article describes banks in 2012 & 2013 were modernizing their Credit Review functions.

1. September 2013 The RMA Journal
28
CREDITRISK
September 2013 The RMA Journal
28

2. September 2013 The RMA Journal 29
Credit review adds value to the underwriting
process by using data analytics and employing
key tests to determine underwriting performance
on automated and manual approvals.
by Jacob Kosoff
i
S
tockphoto
/T
hinkstock
Consumer lending is dominated by automation and analytics.
Lenders approve billions of dollars in consumer loans a year,
relying partly—and, in many cases, fully—on segmentation,
generic credit scores, custom credit scores, and other auto-
decisioning tools. For example, the majority of credit card
applications at major U.S. financial services firms are decided
without a human underwriter.
This article answers the following questions:
• How can credit review add value in examining the auto-
mated underwriting process in credit card, home equity,
and auto lending?
• How can credit review use data analytics to both supple-
ment and target manual transaction testing?
• How is the testing of origination scorecards by credit
review different from the model validation work of a
model risk management group?
How Credit-Scoring Models Are Developed and Used in the
Automated Environment
A credit review professional needs to understand the
objective of the custom score. Origination custom credit
scores are designed to rank-order credit applicants based
on a predefined metric, such as the probability the loan will
become 60 or more days past due within its first 24 months.
Once the score has been developed, the scorecard will
progress through the validation and monitoring process,
which includes a statistical validation prior to implementa-
tion. This validation will include, for example, how statisti-
cally powerful the custom score is by using the Kolmogorov-
Smirnov test for goodness-of-fit.
Understanding the objective of the scorecard and the
monitoring of its performance allows you to better determine
if it is being used as intended.
for Credit Review Examinations
of Consumer
Lending Portfolios
September 2013 The RMA Journal 29

3. September 2013 The RMA Journal
30
Loan-Decisioning Process
At most major financial institutions, consumer loan under-
writing involves an automated process in which applica-
tions flow through a detailed decision engine. A rule-based
underwriting tool, the decisioning engine usually contains
these multiple steps:
1. Segmentation / dual matrix.
2. Exclusions.
3. Credit policy.
4. Credit limit assignment.
5. Exceptions.
6. Pricing.
7. Final decision.
Segmentation / Dual Matrix
Segmentation by economic profitability (EP) is tradition-
ally the first step of any decisioning engine. Its objective is
to split loans into similarly profitable segments. Potential
customers are split by certain characteristics, such as the
length or depth of their bank relationship and by the amount
of revolving debt that would be correlated with higher or
lower EP.
After flowing through a decision tree, the potential cus-
tomer is assigned to a predefined bucket containing similarly
profitable applicants. Each bucket (or node, as it is called
in a modeling environment) has a scorecard assigned to it.
These scorecards are at the heart of the decisioning engine.
Usually, the scorecards are a dual matrix with a FICO score
on one axis and a custom origination credit score on another
axis. In cases where different nodes have very similar profit-
ability values, nodes often are aggregated into segments and
the scorecard is examined at the segment level.
In the simplified example below, the decisioning engine
segments applicants based only on the size of their deposit
relationship with the bank. In the example, deposit relation-
ships with the bank were found to have been an attribute
most correlated to economic profitability. Consequently,
when the decisioning engine was designed, this deposit
size attribute was selected for use in segmenting customers.
In the example, if the applicant has a deposit relation-
ship equal to or greater than $10,000, he or she would
flow to a more “lenient” dual matrix since the bank would
earn a higher economic profit for the loan. Similarly, if
the applicant has no deposit relationship or a deposit re-
lationship less than $10,000, the applicant would flow
to a more “strict” dual matrix. The values in the cells in
Matrix A and Matrix B represent the probability that the
loan would ever go 60 or more days past due within 24
months of origination.
In Matrix A and Matrix B, loans that land in the green
boxes move on the path to auto-approval, loans in the red
boxes move toward the path of auto-decline, and loans in
the yellow move toward the path of recommended approval.
Exclusions
Next, policies and procedures are layered on top using if/
then/else statements to automatically segment based on
certain characteristics, such as geography. In this exclu-
sion step, a decisioning engine usually includes numerous
modules with exclusions. Minimum borrower age and out-
of-market area are traditional exclusion flags that send the
applicant on a path to auto-decline. However, these vary
by financial institution and within financial institutions as
well as by product.
Credit Policy
Credit policy is coded into the automated decisioning system
and is the next checkpoint for all applications. Common
credit policy checkpoints include number of major deroga-
tories, length of credit history, and number of inquires in
the last nine months. If a credit policy flag is triggered, the
loan usually progresses to recommended decline.
Loan applications that land in
the green boxes move on the
path to auto-approval, loan
applications in the red boxes
move toward the path of auto-
decline, and loan applications in
the yellow move toward the path
of recommended approval.
Dual Matrices for Automated Underwriting
Matrix A:
Deposits < $10k
FICO Score
Custom Score
[Low, 660) [660, 720) [720, 780) [780, High)
[Low, 140) 25% 15% 12% 10%
[140, 180) 15% 12% 7% 6%
[180, 220) 11% 8% 2.5% 1%
[220, High) 9% 5% 1% 0.5%
Matrix B:
Deposits >= $10k
FICO Score
Custom Score
[Low, 660) [660, 720) [720, 780) [780, High)
[Low, 140) 25% 15% 12% 10%
[140, 180) 15% 12% 7% 6%
[180, 220) 11% 8% 2.5% 1%
[220, High) 9% 5% 1% 0.5%

4. September 2013 The RMA Journal 31
Credit Limit Assignment
The next module assigns the terms of the loan. The credit
card example below indicates the credit card limit assignment.
Most financial institutions calculate between two and four
credit limits and use the lowest of the calculations. Credit
limit calculations fall into a few categories. In the approaches
below, the credit limit is a percentage of the borrower’s annual
gross income, rounded down to the nearest $500.
FICO/Income Approach to Credit Limit Assignments
In the FICO/income approach to credit limit assignments,
the credit limit is assigned based on the FICO score and
annual gross income. This example shows only nine cells,
but across financial institutions the number of cells ranges
from four to hundreds, especially when FICO is segmented
more narrowly by 10-point increments.
Ability-to-Pay Approach to Credit Limit Assignments
When using the ability-to-pay method, the first step is to
calculate the customer’s current debt-to-income (DTI) ratio.
With credit cards, income is stated and usually unverified.
The first step is to calculate the maximum credit that can
be granted that would prevent a new debt-to-income ratio
from exceeding internal policy—say, 40%. Therefore, if an
applicant currently earns $50,000 a year and his or her
existing debt is $15,000, the current DTI is 30%. Then,
using this ability-to- pay approach, a credit limit of $5,000
would be assigned, making the new DTI equal to 40%.
Credit Experience Approach to Credit Limit Assignments
The final approach in this example involves assessing credit
experience, which applies higher credit limits based on
credit experience.
In the previous examples, the bank would use the lowest
of the calculations, rounded down to the nearest $500.
Exceptions
The next module automatically checks for exceptions.
Warning flags appear for an application when there is a
Social Security number mismatch or when the application
is not in conformance with any of the following: deceased,
minimum income, and Patriot Act. If the application is on
the path to auto-approve after passing through all previous
modules but is flagged for an exception, the loan is put on
the path to recommended approval but it arrives on a hu-
man underwriter’s desk. The underwriter investigates these
exceptions (death, income, etc.) and makes an underwriting
decision to approve or decline the applicant.
Pricing
Economic profitability is again considered when loans flow
through the EP model. The model calculates an inter-
est rate that would generate a positive economic profit,
consequently charging a higher interest rate to applicants
who would require higher economic capital. The model-
produced rate is then rounded up to the nearest applicable
offered rate.
Final Decision
The result of each step is one of four options:
1. Auto-approved.
2. Auto-declined.
3. Recommended approve.
4. Recommended decline.
Recommended approve and recommended decline are, in
FICO/Income Approach—Credit limits are assigned as
a percentage of the applicant’s stated annual income
FICO
Annual Gross Income
< 50k 50k – 100k > 100k
< 680 10% 15% 20%
720 – 759 15% 25% 30%
760+ 20% 30% 35%
Credit Experience Approach—Credit
limits are assigned as dollar values.
Percentage of trade
lines 60 days or
more delinquent in
the last 36 months
Number of months since oldest
revolving bankcard trade line
< 36 36-72 > 72
> 18% 1K 2k 8k
0 – 18% 5K 12k 15k
0 10k 15k 20k
Warning flags appear for an application
when there is a Social Security number
mismatch or when the application is not
in conformance with any of the following:
deceased, minimum income, and Patriot Act.

5. September 2013 The RMA Journal
32
essence, a “maybe.” These applications are sent for manual
(judgmental) underwriting.
How Credit Review Differs from Model Risk Management
Credit review’s role differs from the role of the model risk
management group (sometimes called the model validation
group) in that credit review examines the adequacy,
effectiveness, and analytical rigor of the loan-decisioning
process, in addition to overall credit risk practices and
policies through periodic reviews, process reviews, and
continuous monitoring. Model risk management does not
review the overall loan decisioning process and credit
policies. It assesses the ability of the model to produce
accurate outcomes.
Credit Review Testing
Credit review adds value by examining both auto-decisioned
and manually approved loans. It assesses adequacy of the
examination and tests adherence to credit policies, practices,
and procedures. Credit review must examine the entire
underwriting process from credit scores and risk ratings
to final judgmental decisioning.
Data Requirements
To perform testing, credit review needs access to loan-level
origination and servicing data for each portfolio. It needs
to work with the relevant parties internally to ensure that
data is acquired and refreshed regularly. It also needs access
to up-to-date data dictionaries. Credit review works with
IT partners across the firm to ensure ability to connect its
tools (SAS, Tableau, etc.) directly to the dataset (Oracle,
SAS Data Marts, etc.).
Testing Methodology
Creditreviewcanuseseveraltestsandtestingmethodologies,
including:
1. Reviewing the automated underwriting process.
2. Reviewing soundness of assumptions and conclusions.
3. Using analytics to better target manual transaction testing.
4. Testing policy exceptions.
5.
Analyzing portfolio concentration trends to identify
emerging issues.
Review Automated Underwriting
Credit review’s first step is to review the automated under-
writing process. The purpose of the credit review testing is
to assess if the automated underwriting process is compliant
with existing policies and procedures within the line of
business (LOB). It is also designed to assess the adequacy
of policies and procedures within the LOB and to determine
if it performed sufficient data analytics to create or maintain
a current policy or procedures.
As part of this testing, credit review will look at each
variable in the auto-decisioning process. It will also evaluate
those loans that were inappropriately auto-approved. For
example, credit review might discover loans that have all
the necessary attributes to be auto-approved, but with one
exception: a current major derogatory in the credit bureau
file, indicating that the customer is 120 or more days late on
a different trade line. The customer still has a high enough
What Is Regression Analysis?
Regression analysis is a process used to estimate the relationships among variables.
In this context, it’s a technique for assessing the relationship between certain
credit characteristics of a borrower and the likelihood of that borrower defaulting.
A regression would estimate the correlation between a major derogatory in an
applicant’s credit file and a future loan default by assessing the performance of
hundreds of thousands of loans over a historical period. This result would allow
the reviewer to determine, for example, that a credit card applicant with a major
derogatory in the last 48 months is 20% more likely to become 30 days delinquent
on the card than would a similar applicant who did not have that major derogatory.

6. September 2013 The RMA Journal 33
FICO and custom credit score to pass the specific thresholds;
however, the major derogatory flag in the decision engine
should have moved the applicant from auto-approve to a
manual decisioning process.
Credit review can challenge the adequacy and appro-
priateness of this process by using two testing methods.
The first testing method starts with a review of the overall
portfolio. To obtain this overview, credit review examines
a recent population of consumer loans. It can review any
portfolio (home equity, small business, unsecured lines of
credit, etc.) using these tools.
Assume the consumer credit card portfolio is reviewed
first. Credit review selects all applications within the past 24
months. It’s able to, for example, find the loans that triggered
a major derogatory flag but were still auto-decisioned. Once
credit review has found the issue, the next step is to assess the
severity of the issue. To do this, credit review must evaluate
the impact of the derogatory flag by comparing the share
of auto-approved applications having major derogatories to
the rest of the auto-approved population.
To further assess the importance of this major deroga-
tory flag, credit review can examine a variety of factors to
determine if customers with a major derogatory are per-
forming worse, the same, or better than similar customers,
assuming all other factors are equal. For example, credit
review can pull segments of loan populations and evaluate
the following metrics:
• Default rate on the credit card.
• Net present value (NPV) of the credit card.
• The EP of the credit card relative to the rest of the
population.
If it finds that the variable is not correlated to default, NPV,
or EP, credit review can assign a relatively low rating to the
credit risk issue. However, if credit review finds the variable
to be highly correlated to default, low NPV, or negative EP, it
could assign a relatively high rating to the credit risk issue.
Overall, the severity of auto-approving loan applicants
with a major derogatory, despite documentation stating
otherwise, would be based on numerous factors that credit
review can measure. This testing can be done using statistical
techniques such as regression analysis with tools available
from SAS, STATA, Excel, or others.
Credit review can further explore compensating controls
on these customers. Though they may be approved as fre-
quently and default more often, these customers may have
been granted a lower credit limit, which would reduce the
lender’s exposure to them. Credit review can simply find
the average credit limit of the target population versus a
similar population.
In a second testing method, credit review can examine a
targeted sample of credit bureau files. It manually reviews
these text files to determine if the applicants’ credit history
accurately reflects that they are currently 120 or more days
late on a trade line. If credit review still finds major deroga-
tories that are not flagged by the source system, it can report
to the internal client that the triggers are not populated
correctly and that the data flows need to be improved.
Credit review performs the analytical process described
in the step above to allow future transaction testing to be
more targeted, as it reviews the entire population analytically
prior to cracking open loan files for manual review.
Soundness of Assumptions and Conclusions
The soundness of assumptions can be similarly tested. Con-
sider the following example. Based on the requirements
of the automated-decisioning engine, if the credit card
applicant has $20,000 or more in outstanding revolving
credit, he or she would be required to have a minimum
FICO score of 720 to be auto-approved. If the applicant
has less than $20,000 in outstanding revolving credit, he
or she moves down the path of needing only a 700 score
to be auto-approved.
Outstanding revolving credit would be used to segment
loans into buckets of loans with similar EP because that vari-
able was found to be effective in parsing loans by EP. Credit
review can test the appropriateness of the $20,000 cutoff or,
at a minimum, require analysis of the splits by the LOB or
risk management.
Credit review can run an ordinary least squares (OLS)
regression on the population with, for example, EP or 90
days past due as the de-
pendent variables and
all credit metrics used
in the decisioning as the
independent variables.
If credit review finds the
variable for outstanding
revolving credit to be sta-
tistically insignificant, it
can recommend that
the client reestimate the
segmentation. While one
does not need to be a graduate-level statistician or have
advanced tools to perform this task, a credit reviewer would
need to be familiar with the regression tools within Microsoft
Excel and have a basic understanding of statistics.
Using Analytics to Target Manual Transaction Testing
After credit review has found how common and significant
certain risks are within a portfolio, it can use that infor-
mation to select a targeted sample for manual review. For
example, during the above tests, if credit review determines
that customers with $20,000 or more in outstanding revolv-
ing credit will default more frequently or are approved with
Outstanding revolving
credit would be used to
segment loans into buckets
of loans with similar EP
because that variable
was found to be effective
in parsing loans by EP.

7. September 2013 The RMA Journal
34
more policy exceptions than similar customers, it can use
this variable—outstanding revolving credit—when filtering
the population in the process of selecting a sample to test.
Other variables correlated with default or policy excep-
tions—such as self-employment, those with less than $1,000
in deposits, or those applying online—also can be used as
filters in targeting the sample for manual transaction testing.
Policy Exceptions Testing
Credit review plays a major role in policy exceptions test-
ing. Imagine testing a credit card population of 500,000
approved and booked applications within a specified time
frame. The LOB reports that policy exceptions are rare—
about 5% of approved loans or 25,000 of booked loans.
Although in reality there are dozens of policy exceptions,
imagine, for the sake of simplicity, that there are just four
types:
1. The applicant has a debt-to-income ratio above policy.
2. The applicant is outside the allowable geography.
3. The applicant’s FICO score is below the cutoff for his or
her cohort.
4. The applicant has fewer than 18 months of credit history.
Credit review can look at the default rate, NPV, and EP
of loans approved with each of these exceptions relative to
the portion of the popula-
tion with otherwise similar
characteristics. Suppose
that, for three of the four
exceptions, credit review
finds that the loans booked
performed similarly to
their cohort in terms of
default rate, NPV, and EP.
For those three exceptions,
credit review will raise no new issues as those policy excep-
tions are not increasing portfolio credit risk.
However, assume that the fourth exception, FICO
scores below the cutoff, performs significantly worse than
a similar population across all delinquency and profit-
ability metrics. Using a data analytics tool to investigate,
credit review looks at the wealth management flag or the
deposit balance field, or the EP field, to determine if this
cohort has other compensating characteristics that offset
the higher delinquency rate.
When assessing the inherent credit risk, it is important
to determine what other actions occurred to decrease the
credit exposure. For example, does this population receive
a lower credit limit? Open the actual credit bureau reports
and other documents to search for information not visible in
your dataset. For example, are these customers more likely
to have longstanding, flawless credit histories in Canada that
were not included in U.S. credit bureau reports? Are they
more likely to have other profitable relationships with the
bank, such as IRAs, that compensate for the credit card risk?
By manually opening files with other relevant information,
credit review can more accurately determine the risk of
these policy exceptions relative to the overall population.
Remember, data analytics is not a substitute for manual
transaction testing. It’s a tool to supplement it.
Portfolio Concentration Trending Analysis to Identify
Emerging Issues
Credit review can search for portfolio concentrations in
the 500,000 population by using a data analytics tool like
Excel, Tableau, or QlikView. Are the loans concentrated
in one state? Are the customers’ employers concentrated
in one industry, such as natural gas? Do most customers
have more or less than $30,000 in revolving debt? Credit
review can plot this data over time and perform trending
analysis to determine if any of these concentrations are in-
creasing. Credit review also can perform a trending analysis
on a specific characteristic—say, the share of customers
booked via the Internet—and compare the delinquency
rate emerging from that booming channel relative to the
branch channel.
Conclusion
Credit review can increase its effectiveness in testing the
adherencetoandappropriatenessofpolicybysupplementing
traditional sampling with the use of data analytics. By
performing the analysis described in this article, credit
review will be able to more quickly and comprehensively
assess the entire portfolio, benefiting the line of business
and credit management.
Because of heightened regulatory scrutiny, resource and
budget constraints, and a need to augment the effectiveness
of sampling, this transformation is occurring within many
major financial institutions. As overall consumer lending
moves more toward data-driven decision making and less
toward judgmental underwriting, the transformation within
credit review is likely to keep pace with the transformation
within consumer underwriting.
Through its use of data analytics, credit review will im-
prove processes, broaden coverage, reduce resources need-
ed, decrease reliance on sampling, and produce more timely
and pertinent results. These processes will enhance credit
review’s ability to evaluate credit risk practices, ensuring that
they are consistent with an organization’s desired risk profile
and risk tolerance. The result is increased management ef-
fectiveness and, ultimately, enhanced shareholder value. v
••
Jacob Kosoff is vice president and senior manager, Credit Audit Department, PNC
Financial Services Group. He can be reached at jacob.kosoff@pnc.com. The views
and opinions expressed in this article are those of the author and do not necessarily
reflect the policy or procedures of any particular financial institution.
When assessing the
inherent credit risk, it is
important to determine
what other actions
occurred to decrease
the credit exposure.